DPO Radio
AesirX ComplianceOne | Vietnam Identity Law
VIETNAM IDENTITY LAW [ACTIVE]
The Current Active Identity and Electronic-Identification Stack
Manage identity attributes, eID lifecycle evidence, state-data reuse, authentication records, and VNeID dependencies across Law 26/2023/QH15 and the instruments beneath it.
Why the Vietnam Identity Law Matters
The Identity Law 26/2023/QH15 is Vietnam's parent instrument for citizen identity, the identity card, and the identity database. It is also the legal basis for electronic identification. It took effect on 1 July 2024 and is active law today.
Two instruments sit beneath it, and they do different jobs. Decree 69/2024/NĐ-CP is the active implementing decree covering electronic identity accounts and the authentication levels attaching to them, it is the layer that carries prescribed official forms. Project 06 (Đề án 06) is a national programme applying population data and electronic identification to public and private services; it shapes how organizations integrate with the population database and VNeID, but it is a programme instrument rather than a regulation imposing direct obligations.
A third instrument is often mistaken for part of this stack and must be kept out of it. The Draft Law on Electronic Identification and Authentication is a consultation draft, not enacted law, and is maintained as a separate readiness track on its own page.
That separation is the practical problem this page addresses. Current Decree 69 obligations need execution and evidence today. Project 06 integrations need mapping as dependencies, not as obligations. Draft provisions need monitoring without being treated as binding. ComplianceOne keeps the layers connected without flattening their legal status.
What the Vietnam Identity Law Covers
Dimension
Coverage
Parent framework
Law 26/2023/QH15 on Identity, passed 27 November 2023, effective 1 July 2024, identity information, the identity card, and the identity database.
Active child instrument
Decree 69/2024/NĐ-CP on Electronic Identification and Authentication, issued 25 June 2024, effective 1 July 2024, replacing Decree 59/2022/NĐ-CP.
National programme reference
Project 06 (Đề án 06), approved by Decision 06/QĐ-TTg of 6 January 2022, covering 2022–2025 with a vision to 2030.
Scope
Organizations relying on identity information, electronic identification, authentication, or verified state data.
Operational themes
Identity lifecycle governance; authentication evidence; controlled reuse of verified state data; population-database and VNeID dependency mapping.
Evidence
Attribute inventories, lifecycle records, authentication logs, approvals, and dependency mappings.
Official forms
Seven verified Decree 69 forms, TK01, TK03, and XT01 through XT05. No verified official form is prescribed by the Identity Law or by Project 06.
Status handling
Active baseline managed separately from the Draft Law on Electronic Identification and Authentication.
The Identity Law Instrument Stack
Decree 69/2024/NĐ-CP
Active Implementing DecreeDecree 69 is the operational layer beneath the Identity Law. It governs electronic identity accounts and the levels of authentication that attach to them. It is the only instrument in this stack with verified official forms: TK01 and TK03 for electronic identity account application and for locking or unlocking an account or card, and XT01 through XT05 for electronic authentication service eligibility confirmation, amendment, revocation, and activity reporting.
Project 06 (Đề án 06)
Official National Programme ReferenceProject 06, in Vietnamese, Đề án 06, is Vietnam's national programme for applying population data and electronic identification to public and private services. It was approved by Decision 06/QĐ-TTg, signed by the Prime Minister on 6 January 2022, whose full title is Đề án phát triển ứng dụng dữ liệu về dân cư, định danh và xác thực điện tử phục vụ chuyển đổi số quốc gia giai đoạn 2022 - 2025, tầm nhìn đến năm 2030, the Scheme on developing the application of population data, identification and electronic authentication in service of national digital transformation for the 2022–2025 period, with a vision to 2030.
For compliance teams it matters as the integration layer: it is the programme under which services connect to the population database and to VNeID. ComplianceOne tracks one obligation against it, mapping the population-database, VNeID, and public-service integration dependencies an organization relies on, together with the evidence behind each.
Project 06 prescribes no verified official forms and imposes no direct filing or sanctions obligations. It is therefore represented as a reference layer inside this stack rather than as a separate instrument page, and records created for it are labelled as internal working documents.
Source: Decision 06/QĐ-TTg, 6 January 2022, Prime Minister of Vietnam.
Draft Law on Electronic Identification and Authentication
Draft, Separate TrackThe draft law is not part of this active stack and does not amend or replace Law 26/2023/QH15 or Decree 69. It is maintained as a separate readiness page so draft provisions are never mixed into current obligations or evidence.
How ComplianceOne Supports the Vietnam Identity Law
ComplianceOne holds the identity attribute inventory as governed records rather than a spreadsheet: which attributes an organization processes, where each came from, the lawful basis for its use, and which verified state data it links to. Reuse of verified state data carries its legal basis, source, and traceability on the record itself.
For Decree 69, the platform brings the seven official forms, the electronic identity account lifecycle, and authentication evidence into one controlled workspace. Account creation, activation, change, suspension, and termination events keep their supporting evidence attached. Authentication records retain method, result, timestamp, and the relying service, so an audit question can be answered from the record rather than reconstructed after the fact.
For Project 06, teams map their population-database, VNeID, and public-service integration dependencies and attach the evidence behind each one. This is dependency documentation and evidence management. It is not a production connection to VNeID, and the platform does not represent it as one.
Where identity evidence also serves personal data protection, data governance, or cybersecurity work, the same underlying records can be linked to those obligations while keeping their original framework ownership and audit history.
Related Modules
Data Mapping
Maintains identity attribute inventories, source systems, and population-database or VNeID dependency records.
Explore Data Mapping
Compliance Forms
Supports the seven official Decree 69 forms and keeps internal lifecycle records clearly separate.
Explore Compliance Forms
Access & Accountability
Connects authentication events and account lifecycle changes to accountable owners and approvals.
Explore Access & Accountability
Audit Trail
Preserves contributor, review, approval, and evidence history across the identity stack.
Explore Audit Trail
Program Governance
Assigns ownership and recurring review across the active instruments and the separate draft-readiness track.
Explore Program GovernanceCompare the Difference
Without Structured Framework Operations
With ComplianceOne
Current law and draft proposals are easily conflated.
Keep active and draft identity frameworks distinct.Authentication events lack consistent evidence.Link authentication events to accountable records.VNeID and state-data dependencies are undocumented.Map VNeID and verified-data dependencies with review history.Built for Identity Law Compliance Operations
Status, legal scope, and framework relationships remain visible throughout identity workflows, helping teams distinguish active obligations from draft readiness.
Official identity records, authority-issued artifacts, VNeID dependencies, and internal operational evidence retain clear source labels and legal context.
Contributor, reviewer, approval, authentication, decision, and evidence history stay connected across identity lifecycle activities for audit and regulatory review.
Related Content
See Vietnam Identity Law Compliance in Action
See how ComplianceOne helps structure evidence, ownership, and review for this framework.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
People Also Ask
Yes. Law 26/2023/QH15 and Decree 69/2024/NĐ-CP both took effect on 1 July 2024 and are the active baseline represented by this page.
Project 06 (Đề án 06 in Vietnamese) is Vietnam's national programme for applying population data, electronic identification, and electronic authentication to national digital transformation over the 2022–2025 period, with a vision to 2030. It was approved by Decision 06/QĐ-TTg, signed by the Prime Minister on 6 January 2022. It is the programme under which organizations integrate with the population database and VNeID. Because it is a programme instrument rather than a regulation imposing direct obligations, ComplianceOne represents it as a reference layer inside the Identity stack and tracks it through integration-dependency mapping.
It prescribes no verified official forms and imposes no direct filing or sanctions obligations, so a separate instrument page would overstate its legal role. Its content sits on this page alongside the parent law, and its dependency-mapping work is tracked in the platform like any other obligation.
No. It remains a separate draft-readiness framework and does not replace current law.
No. ComplianceOne documents and evidences VNeID dependencies, which integrations exist, who owns them, and what supports each one. It does not operate a production connection to VNeID.
Yes. The seven verified Decree 69 forms retain their official identifiers: TK01, TK03, and XT01 through XT05. Internal lifecycle records, including Project 06 integration records, are labelled as platform-prepared working documents.
Next Steps
Start a Compliance Pilot
Test scoped workflows, evidence, and review with your compliance team.
Discuss Your Compliance Needs
Review applicability, evidence sources, and operating-model requirements.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
